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Listing of Claims 



determine whether it contains a virus or other malware comprising: 

a) means for generating data with regard to the file to characterise its identity and for 
thereby referencing a computer database to determine whether it is an instance of a known file; 

b) means for selectively subjecting the file to a number of heuristic procedures to 
determine whether or not it contains, or is likely to contain, malware; and 

c) means for determining, in dependence upon the record, if any, of the file in the 
database, whether the file can be regarded as safe in dependence on factors includinR the length 
of time for which the database indicates that the file has been known without mal ware-containing 
instances of it being detected and for controlling the means b) such that the file, if the file is to be 
regarded as safe, is either subject to less thorough processing than if it were not so regarded or 
not subject to processing by the means b) at all. 

Claim 2 (Canceled). 

Claim 3 (Currently Amended): A system according to claim 1 wherein the 
controlling means c) controls th e m e ans b) performs said determining of whether the file can be 
regarded as safe in dependence on factors including sources, recorded in the database, from 
which instances of the file have originated. 

Claim 4 (Currently Amended): A system according to claim 1 wherein the 
controlling means c) controls th e m e ans b) performs said determining of whether the file can be 
regarded as safe in dependence on factors including the number of times, recorded in the 
database, ef instances of the file have been processed. 



Claim 1 (Currently Amended): 



A system for processing a computer file to 
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Claim 5 (Previously Presented): A system according to claim 1 and including means 
for updating the database in dependence upon the result of the processing of the file by the 
means b). 

Claim 6 (Currently Amended): A system according to claim 5 wherein the means 
for updating ef the database, is operative in the event of the means b) determining that the file 
contains, or is likely to contain, malware to delete is such that the record of the file thereof in the 
database is d e l e ted , or to update the record of the file in the database updat e d so that the file [[it]] 
is no longer taken be safe. 

Claim 7 (Currently Amended): A method of processing a computer file to 
determine whether it contains a virus or other malware comprising: 

a) generating data with regard to the file to characterise its identity and for thereby 
referencing a computer database to determine whether it is an instance of a known file; 

b) selectively subjecting the file to a number of heuristic procedures to determine 
whether or not it contains, or is likely to contain, malware; and 

c) determining, in dependence upon the record, if any, of the file in the database, 
whether the file can be regarded as safe in dependence on factors including the length of time for 
which the database indicates that the file has been known without malware-containing instances 
of it being detected and conducting the step b) such that the file, if the file is to be regarded as 
safe, is either subject to less thorough processing than if it were not so regarded or not subject to 
processing by the step b) at all. 

Claim 8 (Canceled). 

Claim 9 (Currently Amended): A method according to claim 7 wherein the 
det e rmining step c) of determining whether the file can be regarded as safe is performed controls 
th e st e p b) in dependence on factors including sources, recorded in the database, from which 
instances of the file have originated. 
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Claim 10 (Currently Amended) A method according to claim 7 wherein the 
d e t e rminin g step c) of determining whether the file can be regarded as safe is performed controls 
th e st e p b) in dependence on factors including the number of times, recorded in the database, 
instances of the file have been processed. 

Claim 1 1 (Previously Presented): A method according to claim 7 and including the 
step of updating the database in dependence upon the result of the processing of the file by the 
step b). 

Claim 12 (Currently Amended): A method according to claim 1 1 wherein the 
updating of the database comprises , in the event of the step b) determining that the file contains, 
or is likely to contain, malwar e, deleting is such that the record th e r e of of the file in the database 
is d e l e t e d , or updating the record of the file in the database updat e d so that [[it]] the file is no 
longer taken be safe. 

Claim 1 3 (New): A system for processing a computer file to determine whether it 
contains a virus or other malware, the system comprising an engine that generates data with 
regard to the file to characterise its identity and for thereby referencing a computer database to 
determine whether it is an instance of a known file; that processes the file by selectively 
subjecting the file to a number of heuristic procedures to determine whether or not it contains, or 
is likely to contain, malware; and that determines, in dependence upon the record, if any, of the 
file in the database, whether the file can be regarded as safe in dependence on factors including 
the length of time for which the database indicates that the file has been known without malware- 
containing instances of it being detected and for controlling the processing to which the file is 
subjected such that the file, if the file is to be regarded as safe, is either subject to less thorough 
processing than if it were not so regarded or not subject to the processing at all. 
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